Glossary

Encryption key

Also called: Data key · Data encryption key · Envelope encryption

An encryption key is a secret value that an encryption algorithm uses to turn readable data into ciphertext and back, so that only key holders can read it.

Services that store many customers’ data often use envelope encryption: data is encrypted with a data key, and the data key is itself encrypted, or wrapped, by a key held in a separate key management service. A stolen copy of the database alone is then unreadable.

Keys also make deletion reliable. Destroying a key makes everything it encrypted unreadable, a technique called crypto-shredding. Some providers let customers hold their own keys, which adds control and also the risk of losing access if the key is lost.